remove data access service apis
no slosilo dependency; use path-based URLs for roles, similar to resources
implement new routing for role kind; pass account to role and resource actions
fix log message
use path-based id for role; use :account/resources root for resources